cors finally working via ajax